API

Base: https://hzmods.lol. Header X-Horizon-Mods-Api: 1. The machine description and the numeric limits sit next to it.

Key

Authorization: Bearer hmk_live_…

The secret is shown once. A key is never wider than the owner's role. A bad key is 401, not anonymous access. Key uploads skip Turnstile. Cookie requests need the X-CSRF-Token header.

Index and updates

Schema 1, source unofficial-horizon-mods. There is no minisign signature and no signed badge. Channel and game go in the query or in JSON.

GET /api/v1/index.json

GET /api/v1/[email protected]&game=26.3&channel=release

GET /api/v1/projects/:id/update?current=1.0.0

Writes

POST /api/v1/mods

POST /api/v1/mods/:id/versions

POST /api/v1/mods/:id/media

GET /api/v1/feed

POST of a page creates the mod. POST of a version accepts multipart and an optional Idempotency-Key. Repeating that key returns the previous response. POST /api/v1/mods/:id/media stores one screenshot or short video. GET /api/v1/feed lists recent published versions.

Default limits

IP: 300 per minute
anonymous reads: 60 per minute, session 180, key 600
session and key writes: 60 and 60 per minute
login: 10 per 15 minutes per IP, and separately per name
registration: 5 per hour
uploads: 20 per hour per account, files up to 104857600 bytes
downloads: 120 and 600 per minute

HTTP 429 includes Retry-After. X-RateLimit-* headers show the tightest window.